Your data is unreadable to your provider, and to us

"And you — can you read our data?"

It is the question that comes up in meetings, sooner or later. The answer has to be verifiable, not reassuring.

Many solutions encrypt at rest, on the server side: the data is encrypted on the backup server's disk. That protects against physical theft of the disk. It does not protect if somebody gains access to the server, since it is the server that holds the key.

BeBackup encrypts at source. Data is encrypted on the machine being backed up, before it leaves, with a key that never leaves that machine. The server stores only unintelligible blocks and the hash of the key — enough to check that an agent presents the right key, never enough to decrypt.

The trade-off, stated plainly

Encryption whose key stays with the client has a consequence that must be said clearly: the key is specific to each workstation and it cannot be replaced. Nobody can regenerate it — neither you nor us.

That is exactly what makes the confidentiality guarantee credible — and it is also what makes the keeping the recovery key safe an operational task in its own right, to be organised before the first deployment. For a provider running an estate, that is a procedure to write, not a box to tick.

A service provider may also choose toimpose a key from the server side for the workstations it administers, if it prefers to centralise that responsibility rather than leave it to each machine. What a service provider takes on

Certificates: issued, imported, renewed

• Internal certificate authority: creating the CA and the certificates, generating CSRs, importing external certificates and regenerating the server certificate — all from the interface.
• Automatic Let's Encrypt: issued from the interface through ACME v2 (tls-alpn-01 and http-01), then automatic renewal 30 days before expiry. Let's Encrypt, Buypass and ZeroSSL are offered, and a custom authority can be given by URL.
• TLS 1.2 floor for browsers, TLS 1.3 for agents.

The certificate that expires on a Sunday morning is an operations classic. Here, renewal depends neither on a scheduled task to write nor on a reminder in a diary.